11 ms·
Breaking GitHub Private Pages for $35k
- deleted 6y ago[deleted]
- deleted 6y ago[deleted]
- reustle 6y agoGetting a 502 error https://web.archive.org/web/20210406074552/https://robertchen.cc/blog/2021/04/03/github-pages-xss https://web.archive.org/web/20210406074552/https://robertche...
- deleted 6y ago[deleted]
- damsta 6y agoPlease consider hosting your blog in a static form as it is being hugged to death.
- sim_card_map 6y agoStatic sites are so 2004.
- dmos62 6y agoConsidering the reemergence of static sites is a relatively recent counter-trend to the prevalence of bulky dynamic sites, you'd probably call dynamic sites so 1989.
- tomwojcik 6y agoTime is a flat circle.
- sim_card_map 6y agoThat was my attempt at sarcasm :) Should've added a /s
- a0-prw 6y agoIt's fine for me.
- pjc50 6y agoMaybe on github pages?
- cupofjoakim 6y agoWell, colour me impressed. The dude's in high school and finds stuff like this? Hopefully it won't get to his head, we've got enough "rock star" devs :)
- Thorncorona 6y agoWas the second part of your comment really necessary?
- heywherelogingo 6y agoYou seem very sensitive.
- jcims 6y agoI worked at a very large bug bounty program for a short spell a few years back. I’ve been in the infosec world since the 90’s, and the number of ridiculously talented teenagers around the world that were sending in very good reports on sophisticated attacks was pretty mind boggling. Yes there was a lot of garbage too, but that was to be expected. I came away thinking that i hope these kids remain engaged and invested in society lol.
- gogopuppygogo 6y agoI knew some teenagers in the warez scene in the 90’s and early aughts. Insanely talented folks. One even runs a bank now...
- paxys 6y agoIf this article was hosted on Github Pages we would have been able to open it..
- dgellow 6y agoArchived here: https://archive.is/b6TYj https://archive.is/b6TYj
- rvz 6y agoVery good find and a payout with a “High” severity bug with a thorough report and for $35k for one person from high school. Great job.
- rizpanjwani 6y agothe write-up mentions that it was reported with another person. Still a very good find.
- weinzierl 6y ago> "That’s because .github.io is not on the Public Suffix List."* I'm confused because I remember github.io always mentioned in explanations of the public suffix list and as rationale why the list exists. Looking at the list it sure enough is there. What am I missing?
- Kwpolska 6y agoI thought it might have been added after the incident, but a `git blame` says otherwise: 7b7f575f public_suffix_list.dat (Simone Carletti 2013-04-23 11:51:10 +0100 11950) github.io
- greenshackle2 6y agogithub.io is on the list. *.github.io is not. They are different. The rule only goes one level down. The github.io rule means foo.github.io cannot share with bar.github.io. However foo.private-org.github.io can share with bar.private-org.github.io. The *.github.io rule would prevent that.
- weinzierl 6y agoOh yes, that makes sense. Thanks!
- timvdalen 6y agoI think the public suffix list only works exactly one level down (otherwise you wouldn't be able to share cookies with sub-levels that _should_ be able to share cookies). Thus, with `github.io' on the list, everything on `*.github.io' can't share with each other, but everything on `*.a.github.io' _can_. The author is sharing between `private-org.github.io' and `private-page.private-org.github.io', which is allowed because `private-org.github.io' (or the more general `*.github.io') isn't on the list.
- iudqnolq 6y agoI think you're missing that github.io is a public suffix but microsoft.github.io or yourcorp.github.io isn't. He finds a publicproj.microsoft.github.io and abuses the fact it shares cookies with privateproj.microsoft.github.io. I think him mentioning {anything}.github.io not being on the public suffix list is a slightly misunderstanding. While true, it's expected. The same is true for {anything}.com.
- yakkomajuri 6y agoGreat writeup!
- brian_herman 6y agoI wish I could work for this guy.
- deleted 6y ago[deleted]
- middlepath 6y agoThis is impressive!! People might call it luck but it isn't. If you are brute forcing, maybe it is luck but brute forcing won't take you anywhere unless the application is pretty amature. Using the right stuff at the right places and strategically chaining bugs just makes things much more interesting.
- Accacin 6y agoJeez. I know I'll never be on this guys level, but where can I go about learning these topics?
- ENOTTY 6y agoYou can start with the Web Application Hacker's Handbook https://portswigger.net/web-security/web-application-hackers-handbook https://portswigger.net/web-security/web-application-hackers...
- deleted 6y ago[deleted]
- EnFinlay 6y agohacker101.com and join the community Discord. There's a ton of Bug Bounty hunting content on the internet. Plenty of room to explore and find your niche.
- deleted 6y ago[deleted]
- peterkos 6y agoAlso, the LiveOverflow YouTube channel has some great, accessible (yet very technical) videos on security!
- lupire 6y agoPunchline: GitHub accepts arbitrary user input and spits it back out into page HTML without verifying it.
- drewbug01 6y ago> Punchline: GitHub accepts arbitrary user input and spits it back out into page HTML without verifying it. Because of a bug related to parsing integers, the behavior you described can happen in the GitHub pages code. However, it is a far cry from "GitHub accepts arbitrary user input and spits it back out into page HTML without verifying it". That's an exceedingly antagonistic way of putting it - and smacks of "I want to make GitHub look dumb by misstating the problem."
- alisonkisk 6y ago> bug related to parsing integers, Right, that's not verifying the result. "alert()" is pretty far cry from an "integer"! How do you even create an "integer" this bad?
- davidhyde 6y agoIs there a technical reason why Microsoft doesn’t use IdentityServer4 with its implementation of the OpenId Connect and Oauth2 technologies. https://github.com/IdentityServer/IdentityServer4 https://github.com/IdentityServer/IdentityServer4. They seem to be pushing it quite hard in Visual Studio and it appears to be designed for this very use case (cross domain authentication). Or do even they think it’s too overkill for GitHub ;)
- tcbyrd 6y agoBecause GitHub Pages isn't written in .NET. However, the general implementation is heavily inspired by this and other similar projects.
- davidhyde 6y agoGitHub Pages doesn't have to be written in .NET to use IdentityServer4 or any other implementation of OpenID Connect and OAuth2 whatever language it may be written in. Anyway, I'm not a fan of OpenID Connect because I personally think that it is overkill for most projects I work on. I was just wondering why Microsoft doesn't use the tech if they are pushing it so hard. > "the general implementation is heavily inspired by this" Inspired but flawed because they "rolled their own"
- ElectricMind 6y agoCongratulations mate. Stay liquid :))
- tcbyrd 6y agoHi from the Pages team! This was such a great find and can't thank you enough for helping ensure Private Pages is as secure as possible. This report helped uncover: - A bug in Openresty where `ngx.redirect` didn't handle unsafe characters [1]. While the fix is now in the latest version of Openresty, a quick patch was to build the URL safely before using it in the redirect. - You should check for case sensitivity when reading `__Host` prefixed cookies, and verify the values against your expected format. It's possible for both `__HOST-Foo` and `__Host-Foo` cookies to exist, and only the `__Host` prefix requires the `Secure` and `HttpOnly` attributes [2]. In our case we strip all cookies at the edge using Varnish (VCL) to ensure no user-supplied cookies make it to our origin, and now we also ignore any "Secure" cookies that don't appear to have been set by our servers. [1]: https://github.com/openresty/lua-nginx-module/pull/1654 https://github.com/openresty/lua-nginx-module/pull/1654 [2]: https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Set-Cookie#attributes https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Se...
- uyt 6y agoI'm not a security expert, but in node.js (specifically express.js) there's a concept of "signedCookies". Usually you can just set a "httpOnly" flag to make sure client-side javascript can't mess with the cookie. But if you also sign the cookie, it further enforces this for any client tampering with the cookie manually too. Because only the server knows the secret for creating a new signature, if the client sends back a cookie that is modified in any way (including case sensitivity), it will be discarded. It should prevent the whole class of bugs caused by "unexpected format".
- Something1234 6y agoThat's very similar to how JWT works. It's a signed message with some keys attached to it.
- uyt 6y agoIt's conceptually the same, but JWT implies a specific data format standard which might be a more involved change architecturally. I'm mentioning the cookie signature stuff because it can be added in an almost blackbox way at the web framework level. Whenever you send back something with set-cookie, also set a signature. Whenever receiving a request, check for that signature too. Though I guess it's not a good idea to try to "roll your own" if your web framework doesn't already support this out of the box. (same disclaimer, I am not a security expert)
- throwaway823882 6y agoSo, who else wants to hire Robert now?
- throwaway823882 6y agoNot to be "that guy" but why would you downvote somebody wanting to hire somebody?
- mot2ba 6y agoDuplicated https://news.ycombinator.com/item?id=26692304 https://news.ycombinator.com/item?id=26692304 Post from real Philip @ginkoid at Github, author also mention him in article.
- aerovistae 6y agoHow in the world does a high schooler have this depth of skill and knowledge? I admit it, I'm jealous, I am.